A company learns that a software vendor they use has suffered a supply chain attack, and the vendor's update mechanism has been compromised. The company has already installed the latest update from that vendor. What is the most immediate action to limit the impact?

Change all user passwords immediately.

Uninstall the update from all systems immediately.

Continue normal operations and wait for the vendor to provide guidance.

Isolate affected systems from the network and investigate for indicators of compromise.

A company wants to reduce the risk of compromised user credentials being used to access sensitive systems. They already require a password. Which additional control would most effectively mitigate this risk?

Use the same password for all systems to simplify user experience.

Disable account lockout after multiple failed attempts.

Implement multi-factor authentication (MFA) for all sensitive system access.

Require users to change their passwords every 30 days.

A hospital stores patient records in a database and transmits them to a specialist's office over the internet. The compliance officer requires that the data be unreadable if the database file is stolen, and that the transmission be protected from eavesdropping. Which combination of controls meets both requirements?

Use a hardware security module (HSM) to store the encryption keys and rely on network segmentation.

Encrypt the database with transparent data encryption (TDE) and use TLS for the transmission.

Use a VPN for the transmission and rely on database permissions to protect the data.

Apply column-level encryption to the patient records and use FTP for the transmission.

A company is implementing a new remote access solution for employees. The security team must balance security with usability. Employees need to access internal applications from personal devices. Which combination of controls provides a strong security posture while maintaining usability?

Require MFA but allow split tunneling so users can access the internet directly.

Require MFA, use a VPN with split tunneling disabled, and enforce endpoint compliance checks before allowing access.

Use a VPN but do not enforce endpoint compliance checks.

Allow direct access to internal applications from personal devices without any additional controls.

GIAC Information Security Fundamentals

Domain 3Objective 4

Defensive Technologies and Emerging Intelligence GISF Practice Questions (Page 9)

Part of the Threats and Defenses domain, which makes up ~36% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~18–29 in this domain), expect 5–7 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

11concepts

Questions 41–45

41application · medium
A company learns that a software vendor they use has suffered a supply chain attack, and the vendor's update mechanism has been compromised. The company has already installed the latest update from that vendor. What is the most immediate action to limit the impact?
Select an answer first
42application · medium
A company wants to reduce the risk of compromised user credentials being used to access sensitive systems. They already require a password. Which additional control would most effectively mitigate this risk?
Select an answer first
43application · medium
A hospital stores patient records in a database and transmits them to a specialist's office over the internet. The compliance officer requires that the data be unreadable if the database file is stolen, and that the transmission be protected from eavesdropping. Which combination of controls meets both requirements?
Select an answer first
44expert · hard
A company is implementing a new remote access solution for employees. The security team must balance security with usability. Employees need to access internal applications from personal devices. Which combination of controls provides a strong security posture while maintaining usability?
Select an answer first
45foundation · easy
Which of the following is a category of defensive technology that focuses on controlling access to network resources based on predefined rules?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISF” is a trademark of its owner, used for identification only.

Defensive Technologies and Emerging Intelligence GISF Practice Questions (Page 9)

Questions 41–45

A company learns that a software vendor they use has suffered a supply chain attack, and the vendor's update mechanism has been compromised. The company has already installed the latest update from that vendor. What is the most immediate action to limit the impact?

A company wants to reduce the risk of compromised user credentials being used to access sensitive systems. They already require a password. Which additional control would most effectively mitigate this risk?

A company is implementing a new remote access solution for employees. The security team must balance security with usability. Employees need to access internal applications from personal devices. Which combination of controls provides a strong security posture while maintaining usability?

Which of the following is a category of defensive technology that focuses on controlling access to network resources based on predefined rules?

Keep studying — Threats and Defenses